TL;DR

• A new, scalable Managed Security Service Provider (MSSP) model is launching to provide affordable, continuous cybersecurity protection for the thousands of underfunded rural water utilities nationwide.
• This formalized service transitions the successful, but non-scalable, DEF CON Franklin cyber volunteer effort, ensuring 24/7 threat detection, incident response, and vulnerability management.
• The MSSP focuses on critical infrastructure protection by monitoring Operational Technology (OT) and providing essential compliance support for evolving EPA mandates.
• Key institutional support comes from the National Rural Water Association (NRWA), the University of Chicago’s Harris Cyber Policy Initiative (CPI), and experts like Jake Braun and Tarah Wheeler.

Table of Contents

• The Necessity of Continuous Cybersecurity: Scaling the MSSP Model
• The MSSP Model: Scope and Technical Design for Rural Water Utilities
• Institutional Support and Key Personnel for the New MSSP Model
• Analysis of Cybersecurity Services Models
• The Expanding Threat Landscape Justifies the New MSSP Model
• Frequently Asked Questions

A first-of-its-kind managed security service provider (MSSP) model is launching to address significant cybersecurity vulnerabilities facing rural water utilities across the United States.

The initiative transitions the successful cyber volunteer effort of DEF CON Franklin into a formal, scalable framework. This MSSP model is specifically designed to provide continuous cybersecurity expertise and threat detection previously unavailable to small water utilities due to severe budget constraints.

Spearheading the effort are key figures from the volunteer community, including Jake Braun, Executive Director of the University of Chicago’s Harris Cyber Policy Initiative (CPI), and expert Tarah Wheeler.

Their goal is to democratize high-level critical infrastructure protection for the thousands of underfunded water systems nationwide.

The transition provides a scalable solution against increasing attacks by cybercriminals and sophisticated nation state groups targeting essential services. The focus is on affordable cybersecurity services, incident response, and continuous monitoring for security threats.

Industry analysts view this as a vital step toward securing drinking water safety and providing necessary compliance support for systems often lacking internal security staff. The structure aims to meet the growing need for protection highlighted by recent warnings from the Environmental Protection Agency (EPA).

This service is expected to work closely with organizations like the National Rural Water Association (NRWA) to ensure broad adoption among eligible small water utilities.

Expert Insight

“There are another 49,000 water utilities that do not support military bases and still need to improve their cybersecurity because they either don’t have the staff, or the resources, to protect themselves,”, Jake Braun, Executive Director of the Cyber Policy Initiative

The Necessity of Continuous Cybersecurity: Scaling the MSSP Model

The shift from a successful cyber volunteer effort to a professional managed security service (MSSP) structure was necessitated by the sheer scale of the national threat landscape. While the initial DEF CON Franklin model demonstrated success in pilot programs across states including Arizona, Idaho, Indiana, Oregon, Utah, and Vermont, the volunteer framework proved impossible to scale effectively.

The challenge lies in providing continuous cybersecurity coverage for the more than 50,000 water utility systems nationwide. Volunteer time cannot provide the 24/7 monitoring required for true critical infrastructure protection.

Jake Braun, co-founder of DEF CON Franklin and a former senior cybersecurity official affiliated with the University of Chicago’s Harris Cyber Policy Initiative (CPI), explained the limitations of the previous approach.

The volunteer model was essential for understanding the unique operational realities of small water utilities, but it does not provide the continuous cybersecurity needed to counter sophisticated, persistent threats. We needed a professional, shared, and affordable framework that offers true cybersecurity expertise.

Mr. Braun confirmed this assessment in an interview with Recorded Future News. The initiative, which also features leadership from experts like Tarah Wheeler, leverages shared resources and centralized threat intelligence to dramatically lower the per-utility cost.

The new MSSP model is designed to provide enterprise-level protection against cyberattacks water systems face daily, without requiring an associated enterprise budget. The framework also closely coordinates with efforts like the Water Watch Center to share relevant threat data.

Democratizing High-Level Security for Rural Water Utilities

The core goal of the rural MSSP model is to offer high-quality threat detection and incident response services at a fraction of the cost large municipalities typically pay. By aggregating the security needs of multiple water utilities, the service achieves vital economies of scale.

This democratization of security is critical for small water utilities operating on thin margins. It also directly addresses a persistent regulatory gap concerning compliance support.

The Environmental Protection Agency (EPA) has previously indicated that a high percentage of inspected water systems fail basic cybersecurity standards. This gap leaves drinking water safety at risk from organized cybercriminals and nation state groups.

Organizations like the National Rural Water Association (NRWA) have stressed the urgent need for accessible cybersecurity services. The financial structure of the MSSP model aims to make security accessible, moving it from a prohibitive capital expenditure to an affordable operational expense.

The MSSP Model: Scope and Technical Design for Rural Water Utilities

The new Managed security service provider (MSSP) framework directly addresses the technical challenges faced by small water utilities. The model, partially derived from lessons learned during the initial DEF CON Franklin volunteer efforts, focuses heavily on rapid response and proactive monitoring of pressure management and Operational Technology (OT) environments.

Crucially, the MSSP design integrates seamlessly with the existing, often outdated, technology used by rural water utilities. Providers recognize that mass hardware upgrades are not feasible given current budget constraints. The goal is to maximize critical infrastructure protection using current assets.

According to a spokesperson for the initiative, the scope of cybersecurity services is designed to provide comprehensive, continuous cybersecurity coverage similar to that offered to larger metropolitan systems. These core offerings prioritize immediate threat mitigation and regulatory adherence.

The key services offered to water utilities cybersecurity clients include:

• 24/7 threat detection and monitoring for security threats and abnormal network activity.
• Real-time threat intelligence tailored specifically to the water sector, informed by data from groups like the Water Watch Center.
• Vulnerability management and system patching support.
• Automated incident response protocols and recovery planning, critical for maintaining drinking water safety.
• Dedicated compliance support for evolving Environmental Protection Agency (EPA) and federal mandates affecting critical infrastructure protection.
• Protection against sophisticated nation state groups and common cybercriminals targeting utility control systems.

This layered approach provides robust security protection for water utilities against both advanced persistent threats and opportunistic cybercriminals.

Jake Braun, a key figure in the initial cyber volunteer effort, noted that this MSSP model ensures high-level cybersecurity expertise is no longer restricted to large, well-funded systems. The goal is to democratize continuous cybersecurity for every member of the National Rural Water Association (NRWA).

Institutional Support and Key Personnel for the New MSSP Model

The transition from the DEF CON Franklin cyber volunteer effort to a formalized, sustainable Managed security service provider (MSSP) model requires significant institutional backing and expert leadership.

This support ensures the technical rigor and long-term viability needed for critical infrastructure protection across the United States.

Collaboration with the National Rural Water Association (NRWA)

The initiative has formalized a critical partnership with the National Rural Water Association (NRWA).

The NRWA provides extensive technical assistance to thousands of small water utilities. This collaboration is essential for ensuring the MSSP model is practical, field-tested, and easily deployable.

This partnership is crucial for extending high-level cybersecurity expertise and cybersecurity services to remote locations often ignored by traditional IT vendors.

Academic Guidance and Key Research

Model refinement and advanced policy development are anchored at the University of Chicago, specifically through the Harris Cyber Policy Initiative (CPI).

Cybersecurity leader and researcher Tarah Wheeler has joined the initiative as a Senior Fellow. Ms. Wheeler is directing research to guide the development of this scalable framework.

Jake Braun, a principal organizer of the original DEF CON Franklin effort, emphasized the need for this academic rigor. The research ensures the framework meets evolving policy demands and anticipates threats from both nation state groups and cybercriminals.

The CPI guidance is vital for building robust compliance support and effective threat detection strategies that align with requirements set by the Environmental Protection Agency (EPA).

Financial Stability and Operational Hub

To stabilize the transition from a purely voluntary structure to a business model focused on continuous cybersecurity, crucial philanthropic support has been secured.

Philanthropist Craig Newmark, founder of Craigslist, is among the notable figures providing initial developmental funding.

This financial backing is stabilizing the initiative, allowing it to provide long-term security solutions rather than relying solely on periodic volunteer efforts.

The funding is directly supporting the establishment of the Water Watch Center. This center will serve as the operational hub for the new Managed security service, coordinating incident response and distributing vital threat intelligence to subscribing rural water utilities.